Setting up MikroTik as a Wi-Fi switch: from connection to fine-tuning

Transform MikroTik into full-fledged managed Wi-Fi switch — a solution that solves two problems at once: it saves space in the server room and adds flexibility to a home or office network. Unlike traditional solutions (where the switch and access point are separate devices), RouterOS This allows you to combine them in a single device without losing functionality. But there's a catch: improper configuration can lead to network loops, reduced Wi-Fi speed, or even complete loss of access to the device.

In this article we will look at A unique MikroTik setup scheme in "switch + Wi-Fi" mode, which works stably even on models with limited resources (for example, hAP lite). You will learn how to:

• 🔌 Connect ports correctly to avoid network loops (loop protection)
• 📶 Set up Wi-Fi with maximum speed (including 802.11ac Wave 2 on supported models)
• 🔒 Separate traffic by VLAN without losing performance
• ⚡ Optimize CPU loadwhen switch mode works in parallel with Wi-Fi

Important: If you use MikroTik in a corporate network, some steps (for example, setting up CAPsMAN (for centralized Wi-Fi management) will require additional adaptation. For home users, we've simplified the process to a minimum—without unnecessary commands in Terminal.

1. Choosing a MikroTik model: what's important for the "switch + Wi-Fi" mode

Not all devices MikroTik They perform equally well as a switch and a Wi-Fi hotspot simultaneously. Key parameters to consider:

⚠️ Attention: Models without hardware switching (for example, RB750Gr3) will process traffic between ports through the CPU. This will result in:

• 🐢 Speed ​​drop under high load (up to 50% of a Gigabit port)
• 🔥 Device overheating during intensive Wi-Fi use
• 🛑 Freezing when enabled FastTrack (if supported)

To check if your model has hardware switching, run the command in Terminal:

/interface ethernet print

Look for the line switch-chip: yes in the output. If it's missing, the device isn't suitable for full-fledged switch mode.

2. Connection diagram: how to avoid loops in the network

The most common mistake when setting up MikroTik like a switch - creation network loop (loop). This happens when:

• 🔄 One of the ports is connected to another switch or router that is already connected to MikroTik via Wi-Fi or a second cable
• 🔌 Enabled STP (Spanning Tree Protocol), but the port priorities are configured incorrectly
• 📡 Wi-Fi bridge (WDS) configured in parallel with a wired connection to the same network

Use this proven wiring diagram:

1. Select one port (eg. ether1) to connect to the main router (if MikroTik not the main one). Set it up as WAN.
2. Other ports (ether2-ether5) combine into bridge (bridge) together with Wi-Fi interface.
3. Turn it off DHCP server on MikroTik, if IP addresses are distributed by another router.

Visually, the diagram looks like this:

[Main router]
│
▼
[MikroTik ether1] ← WAN (DHCP client)
│
├─ [ether2-ether5 + wlan1] ← Bridge (LAN)
│
▼
[Network devices: PCs, printers, IP cameras]

⚠️ Attention: If you connect MikroTik to a network where there are already other switches with the power on STP, set the bridge priority (bridge priority) so that your device does not become rooted. For example:

/interface bridge set 0 priority=0x8000

3. Step-by-step setup of switch mode in Winbox

Let's move on to the practical part. We will use Winbox (version 3.30+) as it provides more visual cues than WebFigIf you have MikroTik With RouterOS v7, the interface may be slightly different, but the logic remains the same.

Disconnect all cables from the MikroTik except for the power supply and one patch cord to the PC | Reset the configuration to factory settings (/system reset-configuration no-defaults=yes)|Update the firmware to the latest stable version|Connect via MAC address if you lose access via IP-->

Step 1. Creating a Bridge

The bridge will combine wired ports and Wi-Fi into one network:

1. Open Winbox → Interfaces → Bridge.
2. Click +, please provide a name (eg. LocalBridge).
3. Tab Ports: add all LAN ports (eg. ether2-ether5).
4. Click OK.

Step 2: Configuring Wi-Fi as part of the bridge

Now let's connect the wireless interface:

1. Go to Wireless → wlan1 → Advanced Mode.
2. In the tab General select mode ap bridge.
3. In the tab Bridge specify the created bridge (LocalBridge).
4. Set up SSID, encryption (WPA2-PSK or WPA3) and password.

⚠️ Attention: If you use CAPsMAN To manage multiple access points, do not add wlan1 into the bridge directly. Instead:

1. Create CAPsMAN interface V Wireless → CAPsMAN → Interfaces.
2. Add this interface to the bridge.

Step 3: Configuring IP Address and DHCP

If MikroTik not the main router in the network:

• 🌐 Assign a static IP from the main router's subnet (e.g. 192.168.88.2/24, if the main router has 192.168.88.1).
• ❌ Turn off DHCP server V IP → DHCP Server.

If MikroTik — main router:

• 🔧 Set up DHCP server on the bridge (LocalBridge).
• 🔒 Turn on NAT V IP → Firewall → NAT (rule masquerade).

4. Performance Optimization: Switch + Wi-Fi without Lag

When MikroTik When operating simultaneously as a switch and an access point, the CPU load can increase sharply. This is especially noticeable on models with a weak processor (for example, hAP lite With AR9344). Here's how to reduce the load:

4.1 Enabling hardware acceleration

For models with Switch Chip:

• 🔧 Turn on Hardware Offloading:

/interface bridge settings
set use-ip-firewall=yes
set use-ip-firewall-for-pppoe=yes
set use-ip-firewall-for-vlan=yes

This will move the processing of traffic between bridge ports from the CPU to the hardware chip.

4.2. Wi-Fi Optimization

To prevent Wi-Fi from hogging all your resources:

• 📶 Set a fixed channel (eg. 5 GHz, channel 36, width 80 MHz) instead of auto.
• 🔄 Disable unnecessary standards in Wireless → Security Profiles → [your profile] → Supported RatesLeave only VHT For 802.11ac.
• 📊 Limit the maximum number of clients:

/interface wireless set wlan1 max-station-count=20

4.3. Configuring Queue Tree for Traffic Prioritization

If there are critical devices (IP cameras, VoIP phones) on the network, create a rule Queue Tree:

/queue tree add name="VoIP Priority" parent=LocalBridge \
packet-mark=voip priority=1 limit-at=50M max-limit=100M

/system routerboard settings set cpu-frequency=auto multi-cpu=yes

This will increase performance by 15-30% under high load.-->

5. Security: Protect your switch and Wi-Fi from hacking

A device in Wi-Fi switch mode becomes vulnerable to:

• 🕵️‍♂️ ARP spoofing (interception of traffic between devices in the same segment)
• 🔓 Wi-Fi password cracking (if a weak one is used) PSK)
• 🚪 Unauthorized access to Winbox through open ports

5.1. Protection against ARP attacks

Turn on ARP Mode in mode secure:

/interface bridge settings set arp=proxy-arp

And add a rule to the firewall:

/ip firewall filter add chain=forward action=drop \
arp=invalid src-mac-address=00:00:00:00:00:00

5.2. Secure Wi-Fi

Minimum requirements for securing a wireless network:

• 🔐 Encryption: WPA3-PSK (or WPA2-PSK AES-CCM for older devices)
• 🔑 Password: at least 12 characters with, numbers, and special characters
• 📡 Hiding SSID: hide-ssid=yes (does not protect against scanning, but reduces the number of connection attempts)
• 🛡️ MAC filtering: /interface wireless access-list add mac-address=XX:XX:XX:XX:XX:XX

5.3. Restricting access to Winbox

By default MikroTik available at:

• MAC-Telnet (port 20561)
• Winbox (port 8291)
• SSH (port 22)
• WebFig (port 80, 443)

Disable unnecessary services:

/ip service disable"telnet,ftp,www,api,api-ssl"

And restrict access by IP:

/ip firewall filter add chain=input src-address=192.168.88.0/24 \
action=accept protocol=tcp dst-port=8291,22

/system reset-configuration no-defaults=yes

6. Configuring VLANs to separate traffic

If you need to divide your network into several virtual segments (for example, for guest Wi-Fi or IP cameras), use VLAN. IN MikroTik This is realized through:

• 🌉 VLAN filtering on the bridge
• 🔖 Port tagging (tagged/untagged)

6.1 Creating VLANs on a Bridge

Example: let's divide the network into LAN (VLAN 10) And Guest (VLAN 20).

1. Turn on VLAN filtering:

/interface bridge settings set vlan-filtering=yes

2. Create a VLAN:

/interface bridge vlan add bridge=LocalBridge tagged=LocalBridge,ether2-ether5 \
untagged=none vlan-ids=10
/interface bridge vlan add bridge=LocalBridge tagged=LocalBridge,ether3-ether5 \
untagged=ether2 vlan-ids=20

In this example:

• ether2 — port for guest devices (untagged traffic) VLAN 20)
• ether3-ether5 — ports for the main network (tagged traffic) VLAN 10 And VLAN 20)

6.2. Configuring Wi-Fi for VLAN

To ensure that Wi-Fi clients are assigned to the correct VLAN:

1. Create two virtual Wi-Fi interfaces:

/interface wireless add master-interface=wlan1 name=wlan1-lan \
ssid="MyLAN" security-profile=my-security
/interface wireless add master-interface=wlan1 name=wlan1-guest \
ssid="GuestWiFi" security-profile=guest-security

2. Add them to the bridge with VLAN specification:

/interface bridge port add bridge=LocalBridge interface=wlan1-lan pvid=10
/interface bridge port add bridge=LocalBridge interface=wlan1-guest pvid=20

6.3. Configuring DHCP for VLANs

Each VLAN requires a separate pool of IP addresses:

/ip pool add name=lan-pool ranges=192.168.10.2-192.168.10.254
/ip pool add name=guest-pool ranges=192.168.20.2-192.168.20.254
/ip dhcp-server add name=lan-dhcp interface=LocalBridge lease-time=1d \
address-pool=lan-pool
/ip dhcp-server add name=guest-dhcp interface=LocalBridge lease-time=1h \
address-pool=guest-pool

7. Troubleshooting: Why the Switch or Wi-Fi Doesn't Work

If something goes wrong after setup, use this table for quick diagnostics:

⚠️ Attention: If after setting up MikroTik stopped responding, but the port indicators are on:

1. Connect via MAC-Telnet (as described in the spoiler above).
2. Check the logs:

/log print

3. Look for errors like bridge,info port received packet with own address - this is a sign of a loop.

8. Alternative use cases

MikroTik In Wi-Fi switch mode, you can adapt it to various tasks. Let's look at three popular options:

8.1 Guest network with client isolation

To prevent guests from seeing devices on the main network:

• 🔒 Set up VLAN 20 for guest Wi-Fi (as in section 6).
• 🚫 Add a firewall rule to block traffic between VLANs:

/ip firewall filter add chain=forward in-interface=wlan1-guest \
out-interface=wlan1-lan action=drop

8.2. Remote control of IP cameras

If the cameras are connected to the ports MikroTik, but you need to access them from the Internet:

• 📹 Allocate cameras to a separate VLAN (for example, VLAN 30).
• 🌍 Set up Port Forwarding:

/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 \
action=dst-nat to-addresses=192.168.30.100 to-ports=80

8.3. Backup channel via 4G

If the main Internet connection is lost, you can automatically switch to LTE:

• 📶 Connect 4G modem into the USB port MikroTik.
• 🔄 Set up Failover:

/ip route add dst-address=0.0.0.0/0 gateway=pppoe-out1 \
check-gateway=ping distance=1
/ip route add dst-address=0.0.0.0/0 gateway=lte1 \
check-gateway=ping distance=2

FAQ: Frequently asked questions about setup

/interface wireless set wlan1 country=russia tx-power=20

/interface wireless connect-list add interface=wlan1 \
ssid=MeshNetwork